FortiOS CVE-2026-71408

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special prerequisites: exploitation requires only network reachability to the affected FortiOS device, with no authentication, no user interaction, and no elevated complexity. However, the CVE description contains a literal placeholder ('via <insert attack vector here>'), meaning the precise triggering service, protocol, or endpoint is not publicly known, preventing defenders from applying targeted mitigations. Impact is bounded to partial availability degradation (A:L) with no confidentiality or integrity compromise. No non-default configuration is indicated as required by the available data. Devices across FortiOS 6.4.x, 7.0.x, 7.2.x, 7.4.x, and 7.6.x running unpatched versions that expose network services are within scope.

The CVSS base vector AV:N/AC:L/PR:N/UI:N indicates network-reachable, unauthenticated, low-complexity exploitation, though the impact ceiling is low (A:L only - partial availability degradation, no confidentiality or integrity exposure). The temporal metrics are notable: E:P confirms proof-of-concept code reportedly exists, while RL:O confirms an official remediation is released, narrowing the window for unpatched exposure. No EPSS score was supplied in the input data, and the CVE is absent from CISA KEV, suggesting no confirmed mass exploitation at time of analysis. The broad version sweep - six-plus years of FortiOS branches from 6.4.x through 7.6.6 - means a large fraction of Fortinet estates are potentially in scope if patch cadence is slow. FortiOS appliances typically serve as VPN gateways and perimeter firewalls, so even a low-severity DoS can disrupt remote-access connectivity and network enforcement for entire organizations. The missing attack vector detail in the description prevents precise compensating control targeting, which slightly elevates real-world risk relative to the low CVSS availability score alone.

An unauthenticated remote attacker sends a volume of specially crafted network requests to an exposed FortiOS service, triggering repeated resource allocations without corresponding throttling or release, progressively exhausting system resources until the appliance becomes unresponsive to legitimate traffic. Given the E:P temporal metric, proof-of-concept code reportedly exists, lowering the technical barrier for opportunistic actors. The specific triggering protocol is not disclosed in the current advisory text, but perimeter-facing management interfaces and VPN services on unpatched FortiOS appliances represent the likely target surface.